Privacy Policy

What we collect

• Your account, if you create one. You can sign in with Google. We never see or store a password. From Google we receive your name, email address and profile picture, and we keep them so we can show who you are and attribute anything you contribute. While you're signed in we also store the IP address and browser your session was created from, which is how a session can be recognised and, if needed, revoked. The whole site works without signing in.
• Anonymous, cookieless usage analytics. We record which pages are viewed and a few key interactions so we can see what's useful and improve the site. It runs without cookies (nothing is stored on your device) and stays anonymous — even when you're signed in. We never connect your account to your analytics events. Visitors in the UK/EU/EEA & Switzerland are asked to opt in first via a banner; elsewhere this privacy-friendly analytics runs by default.
• Email — only when you give it. If you ask us to save your Surf Level shortlist, or to be notified about a coming-soon region, we keep the email you enter solely to send that — we never sell it or use it for anything else, and you can ask us to delete it anytime. The quiz itself works without an email.
• Outbound-link clicks. When you click a link to a camp's own website, we record that the click happened (to understand which listings are useful). We do not attach your identity to it.
• Feedback & corrections. If you send feedback or report incorrect info, we keep your message. Providing an email is optional, and we don't store it alongside the report content.
• Camp claim requests. If you tell us you run one of the camps we list, we keep what you send — your name, your email, your role, and any note — so we can get back to you about it. That's the whole purpose; we don't use it for anything else.

We do not collect payment details (bookings happen on the camp's own site), and we don't ask for more than the above. There is no advertising on this site, no ad or attribution tracking, and we never share data with data brokers.

Analytics & cookies

We use PostHog (EU region) for privacy-conscious product analytics — pageviews and a few key interaction events. It's configured to be cookieless and anonymous: it sets no tracking cookies or local storage, doesn't profile you, and doesn't record your screen. PostHog is our data processor under a data-processing agreement, and data is processed in the EU.

Your region decides how it runs. If you're in the UK, EU/EEA, or Switzerland, we ask you to opt in via a banner first (decline and nothing is collected). Everywhere else, this privacy-friendly analytics runs by default — you can still opt out by emailing us or using your browser's Global Privacy Control / Do-Not-Track signal. Either way, the whole site works.

The cookies we set. By default, just two small functional ones: a flag recording whether the consent banner applies in your region, and — once you answer it — your banner choice. Neither holds personal information, and neither is used for advertising.

If you sign in, we also set a session cookie so you stay signed in between pages. It is read only by our server, sent only over HTTPS, and expires after 7 days. Signing out clears it. A short-lived cookie (five minutes) is also used during the Google sign-in round-trip to protect against request forgery.

Who we share data with

We don't sell your data. We rely on a few service providers to run the site:

• Vercel — hosting and delivery of the website.
• Neon — the database that stores account and site data. It runs in the United States.
• Google — only if you choose to sign in with Google. Google tells us your name, email and profile picture; we don't tell Google anything about what you do here. Google's own privacy policy covers their side.
• PostHog — the analytics described above.
• Cloudflare — routes email sent to our @surfcampscout.com addresses.
• Camp / booking partners — only when you click out to them. Once you leave our site, their own privacy policy applies. See our affiliate disclosure.

Where your data lives. Our analytics is processed in the EU. Account data is stored in the United States, so if you're in the UK or EU/EEA, signing in means your name, email and session details are transferred there. You can use the entire site without signing in, in which case no account data exists to transfer.

Your choices

• You can ask us what data we hold about you, and ask us to delete it — email us and we'll do it by hand. We're being straight with you: there is no self-serve delete button yet. Building one is the next thing on our list, and until it exists, email is the way. (UK/EU/EEA visitors have access, deletion, and objection rights under GDPR/UK-GDPR; Canadians under PIPEDA; Californians under the CCPA/CPRA.)
• If you have an account, you can also sign out on any page — that ends the session immediately. Signing out doesn't delete your account; ask us if that's what you want.
• UK/EU/EEA & Swiss visitors can decline analytics in the banner — nothing is tracked. Everywhere else you can opt out via your browser's Global Privacy Control / Do-Not-Track signal, or by emailing us.
• If you gave us your email, you can ask us to remove it at any time.

We do not sell or share your personal information (clicking an affiliate link is not a data sale), and we don't use it for anything you didn't ask for. UK/EU visitors can also complain to their data-protection authority (in the UK, the ICO).

How long we keep things

• Your account — until you ask us to delete it.
• Sign-in sessions — a session stops working after 7 days, or as soon as you sign out.
• An email you gave us — until you ask us to remove it.
• A camp claim request — until it's resolved, then as a record that we handled it. Ask us and we'll delete it.
• Analytics — anonymous from the start, so there's nothing in it tied to you to keep or delete.

Children

Surf Camp Scout is intended for adults planning surf travel. It is not directed at children, and we don't knowingly collect data from them.

Changes

If we change this policy, we'll update the date at the top. Significant changes get called out clearly. On 26 July 2026 we added Google sign-in, and updated this policy the same week to describe the account data, the session cookie and the US database that came with it.

Contact

Questions about your data, or want it deleted? Email hello@surfcampscout.com and we'll help. You can also send a note via our feedback form.